Trust at Draft
Security & data handling
Understand how information moves through Draft before you bring your hiring team and candidates into a workspace.
Prepared October 5, 2026 · Operated by Hubtal OU, Estonia
Account and workspace access
Draft uses account authentication and workspace membership checks. Billing management is restricted to the workspace owner. Client reviewers access the candidates assigned to them through the client portal.
Connected AI assistants have permissions for a selected workspace. Connections can be revoked in Settings. Revoking access prevents future requests; it does not remove information already received by an external provider.
Services and AI processing
The following services support Draft’s features. Which services receive information depends on the workflow and integrations used. This overview is not a contractual subprocessor schedule or a data-residency guarantee.
- Supabase
- Account authentication, application database and uploaded files.
- Vercel
- Application hosting and website analytics.
- OpenAI
- AI features including CV parsing, profile processing, matching and writing assistance. Depending on the feature, candidate text or document images are sent for processing.
- Resend
- Sending application emails, invitations and notifications.
- Stripe
- Hosted subscription checkout and billing management.
- Google Calendar
- Interview scheduling when a team member connects a calendar.
- ipapi.co
- IP-based location lookup where used by application and offer-signing flows.
Some AI processing runs as part of document processing and background matching, rather than only when you open an assistant. External assistant connections are separate and may receive candidate information under the permissions your team approves. See our privacy policy for more information.
Confirm the required processing regions, provider terms and suitability for your data with us before uploading sensitive documents. Do not use an ATS evaluation to upload patient records.
Retention and removal
Removing a candidate from a company’s talent pool is different from deleting their personal data. Draft has retention processing for candidate records, but removing a profile from view should not be treated as confirmation that every document, email or backup has been erased.
For access, correction or erasure requests, use the contact details in our privacy policy. Confirm your organisation’s retention requirements before importing candidate records.
Independent assurance
This page does not provide a SOC 2 report, ISO 27001 certificate, Cyber Essentials certificate or independent penetration-test report. It should not be read as a claim that Draft holds those credentials.
Our service providers’ certifications do not certify Draft. Automated software checks are also different from an independent security assessment. If your procurement process requires a particular report or contractual commitment, confirm its availability with us before proceeding.
Questions and privacy requests
Our privacy policy and contact details and terms of service explain the current published position. This overview does not replace those documents or create a service-level commitment.
When reporting a concern, describe the affected feature and steps to reproduce it with fictional data. Do not include passwords, access tokens or candidate documents in an initial message.